npm Hallucination Attack: Detecting Phantom Dependencies in AI Code

Discover how npm hallucination attacks work when AI assistants generate fake dependencies. A practical guide for developers shipping AI-generated code safe

When AI Assistants Create Non-Existent Dependencies

In 2024, a developer used ChatGPT to scaffold a new Node.js project. The assistant generated a package.json with several dependencies, all of which seemed legitimate. The developer ran npm install without verifying. One of those packages didn't exist on npm. Another was a typosquatting attack. The third was legitimate but outdated with known vulnerabilities.

This isn't an edge case. LLMs hallucinate package names regularly, creating what security teams now call "npm hallucination attacks."

Why npm Hallucination Happens

AI models generate code based on training data patterns. When asked to generate dependencies for a specific use case, they sometimes produce plausible-sounding package names that don't exist, or worse, they suggest legitimate packages but with incorrect versions or malicious variants.

The risk is simple: a developer running npm install from AI-generated code can pull in:

Non-existent packages (typosquatting attacks)
Outdated versions with known CVEs
Malicious variants designed to mimic popular packages
Legitimate packages installed to unexpected registry mirrors

The npm Hallucination Attack in Action

Consider this AI-generated code:


// AI-generated package.json
{
  "dependencies": {
    "express": "^4.18.0",
    "axios": "^1.4.0",
    "bcrypt-util": "^2.0.1",  // HALLUCINATION: doesn't exist
    "lodash": "^4.17.21"
  }
}

When the developer runs npm install, npm searches for bcrypt-util. It doesn't exist on the official registry, so an attacker with a typosquatting package under that name would get installed instead. Or the installation fails silently, and the code breaks at runtime.

Detection Strategies for npm Hallucination Attacks

1. Verify Every Package Before Installation

Before running npm install, audit the package.json:


# Check if packages actually exist
npm view package-name

# Use npm audit to check for known issues
npm audit

# Check the registry directly
curl https://registry.npmjs.org/package-name

2. Use Deep Security Analysis Tools

Automated scanning tools can compare package lists against the official npm registry and flag hallucinations automatically. Deep Security Analysis systems should verify:

Package existence on the official registry
Version compatibility
Known vulnerability databases
Suspicious installation patterns

3. Implement Dependency Lock Files with Verification


# Generate and verify lock files
npm ci --audit

# Use package-lock.json for reproducible installs
# Commit verified lock files to version control

Key Takeaways

npm hallucination attacks occur when AI assistants confidently generate non-existent package names
Always verify package.json files generated by AI tools before running npm install
Implement Deep Security Analysis tooling that validates dependencies against the npm registry automatically